Hey,
I converted my 3 server setup within a day and without any (visible)
hiccup(s). Thank you for that!
The only issue is that I do not have any CA or CRL Server anymore. The
first Server (no1, updated last) warned me, but I was unable to
designate any other to this role.
Any pointer on how to remedy this situation?
Cheers,
Chris.
On 02/04/2020 20:15, Rob Crittenden wrote:
The recommended way is your first point: decommission one, reinstall
with new OS, add back to the pool. Rinse and repeat.
Things to remember:
- ensuring that the DNA range is preserved (it can be automagic but
watch out for it). See the ipa-replica-manage command for showing the
ranges.
- ensure that one master is defined as the CRL generator (and only one)
- ensure that one master is defined as the CA renewal master
- ensure you maintain the roles (and have at least 2 of everything)
- watch the replication topology when it's done and adjust as needed
We generally recommend that this transition happen over a fairly short
period of time, week(s) not months.
--
with kind regards,
mit freundlichen Gruessen,
Christian Reiss